Skill rating

Identify storage buckets that are publicly accessible and may contain sensitive data.

Attempt to list and read files from storage buckets to verify access controls.

Analyze Supabase authentication configuration for security weaknesses and misconfigurations.

CRITICAL - Detect exposed PostgreSQL database connection strings in client-side code. Direct DB access is a P0 issue.

Subscribe to realtime changes in Supabase using WebSocket connections. Use for listening to database changes, presence tracking, and broadcast messaging.

Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.

Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.

Extract the Supabase project URL from client-side JavaScript code, environment variables, and configuration files.

Automate Supabase database queries, table management, project administration, storage, edge functions, and SQL execution via Rube MCP (Composio). Always search tools first for current schemas.

Expert knowledge for deploying to Vercel with Next.js

Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.

Expert debugger for Next.js + Cloudflare Workers + Supabase stacks. Systematic troubleshooting for auth, caching, workers, RLS, CORS, and build issues. Activate on: 'debug', 'not working', 'error', 'b

Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the u

This runbook outlines the process for launching a micro-SaaS. Each step must be explicitly completed and documented.

Enables the agent to create, manage, and publish a full-featured blog autonomously. The agent can write posts, upload media, switch between 10 premium design themes, and deploy the blog to Cloudflare

X Spaces, but for AI Agents. Live voice rooms where AI agents host conversations.

Capture leads into a centralized Supabase database with automatic Make.com email automation.

Deploy and manage Supabase Edge Functions. Use for invoking serverless functions, deploying new functions, and managing function deployments.

CRITICAL - Detect if the Supabase service_role key is leaked in client-side code. This is a P0 severity issue.

Test if user signup is open and identify potential abuse vectors in the registration process.

Extract and decode Supabase-related JWTs from client-side code, cookies, and local storage patterns.

List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.

Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.

Build a fully automated AI-powered data collection agent for any public source — job boards, prices, news, GitHub, sports, anything. Scrapes on a schedule, enriches data with a free LLM (Gemini Flash)

**MANDATORY for ALL MCP server work** - mcp-use framework best practices and patterns. **READ THIS FIRST** before any MCP server work, including: - Creating new MCP servers - Modifying existing MCP s

Guided onboarding and best practices for building applications with PowerSync — Cloud and self-hosted setup, sync configuration, client SDK usage, backend integration (Supabase, custom Postgres, Mongo

**MANDATORY for ALL MCP server work** - mcp-use framework best practices and patterns. **READ THIS FIRST** before any MCP server work, including: - Creating new MCP servers - Modifying existing MCP s

**MANDATORY for ALL MCP server work** - mcp-use framework best practices and patterns. **READ THIS FIRST** before any MCP server work, including: - Creating new MCP servers - Modifying existing MCP s

Battle-tested growth hacking playbook for B2B SaaS, AI products, and developer tools. Covers viral loop design, acquisition channel experiments, retention hooks, activation optimization, and referral

ORQUESTADOR REAL para el ciclo completo de desarrollo Full-Stack. Conecta a Supabase, genera migrations SQL ejecutables, y guía paso a paso. Integración con Vercel para deployment automático.

Writes and runs tests (unit, integration, E2E), performs linting, and auto-fixes failures

Integrate your AI agent with CLAW99 — the AI agent contest marketplace on Base.

Simplifie le déploiement d'apps web sur Vercel, Railway et Supabase via leurs CLIs.

提供小学、专四、专八英语听力材料，支持获取材料列表和详细段落。

Project Guidelines Skill (Example)

Create a test user (with explicit permission) to audit what authenticated users can access vs anonymous users. Detects IDOR, cross-user access, and privilege escalation.

List all storage buckets and their configuration to identify the storage attack surface.

List all tables exposed via the Supabase PostgREST API to identify the attack surface.

Attempt to read data from exposed tables to verify actual data exposure and RLS effectiveness.

Test for user enumeration vulnerabilities through various authentication endpoints.

Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.

Quick reference for all Supabase security audit skills with usage examples and command overview.

PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices.

Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.

Public review registry for OpenClaw skills. Agents can publish versioned reviews and read community feedback.

XP system for productivity gamification via ClawdBot - track levels, badges, streaks, and achievements

Pre-production validation gate for Vercel/Supabase/Firebase stack — generates test plans, executes test suites, validates APIs, UI, toasts, LLM output quality, and produces go/no-go reports

Integration architect for multi-app monorepos — shared contracts, API-first design with OpenAPI, cross-app auth, auto-generated SDKs, and full MCP server scaffolding per app

为任意 HTML 原型、Vue (2/3)、React (17/18/Next.js) 项目一键植入「交互式 PRD 打点标注器与多版本规约生成系统」。具备跨框架自主识别与前置确认协议 (无法自动识别时前置询问框架与应用范围)、全球 4 语言架构 (中/英/日/韩: zh-CN, en, ja, ko)、四模态持久化体系 (⚡Supabase Serverless 数据库直读直写 / 🔑JSON

Extract the Supabase anon/public API key from client-side code. This key is expected in client apps but important for RLS testing.